Evolving Kubernetes security with Vault and OpenShift
summary
Shows concrete integration steps: use Secrets Store CSI Driver or the agent sidecar to mount Vault secrets so they never persist in etcd, or pick External Secrets Operator (ESO) versus HashiCorp’s VSO for automatic sync, rotation and pod restarts; Vault 1.21 adds pod direct secrets (initially KV and AppRole) to bypass Kubernetes secrets; KubeKMS v2 stores the key-encryption-key in Vault with no measurable performance hit; cert-manager + Vault supplies Istio/OpenShift service-mesh and API/ingress TLS; Quay.io can use short-lived Vault tokens.
AI-written summary · about
chapters (12)
- 0:00Introduction and speakers
- 1:21What is a secret
- 2:25Managing Kubernetes secrets
- 3:05Why use Vault
- 4:49Vault and OpenShift integration
- 7:17Secret Store CSI driver
- 9:01Vault agent sidecar
- 10:04Vault Secrets Operator vs External
- 13:35Pod direct secrets in OpenShift
- 14:39KubeKMS v2 with Vault
- 16:45Zero trust with Vault
- 18:33Summary and closing
related talks
39mManaging and securing Kubernetes secrets - Simon Pearce
23mUsing Hashicorp Vault in Kubernetes Clusters
41mEasy Secrets in Kubernetes: Because I Vault It Well
23mVault for Secrets Management and TLS in Consul K8s
49mManaging Secrets in a Kubernetes Cluster with Hashicorp Vault
08mKubernetes Secret Management The Right Way With Vault
31mVault and Secret Management in Kubernetes
24mCan You Keep a Secret? On Secret Management in Kubernetes